From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id EACEEB4FE; Wed, 26 Nov 2025 19:37:25 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 7F413B46D; Wed, 26 Nov 2025 19:37:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yx1-xb131.google.com (mail-yx1-xb131.google.com [IPv6:2607:f8b0:4864:20::b131]) by atuin.qyliss.net (Postfix) with ESMTPS id 81DB3B423 for ; Wed, 26 Nov 2025 19:37:04 +0000 (UTC) Received: by mail-yx1-xb131.google.com with SMTP id 956f58d0204a3-640c9c85255so175518d50.3 for ; Wed, 26 Nov 2025 11:37:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764185822; x=1764790622; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=S9VX4Wwm6Gu8sDkxRY5IZbodfOdqEkYeGpnLMouiQXg=; b=dFp9gkLY/Rj/plI8r3tuWLGa2qVXf0cqxckXMqPtEu0EptXjYfATSxUgS6vgm/xhpk Dl0rz+dd2Yyb40kv+jnEkwd1cqKJyMnDdnfTcMiI7V1/zQrvOEO45xO0oWHIG3sMAlBc n5hm4PEoqmPI9jIy96YZrJGhhTwFq7NqPF4S8VKsL3xQ21SHTjm4KgN3Y2PhiYnGxg/j Z/HZvosXX5SDFve8pDaEF8ix6scZ2U6B0q+9hX9YQocO/Nn16Od8pNeH5C+sm8HJ23nD OiKcNv8W9GF+eBNdP/LJinWsgyKvJjRB+jrqJ9R5NaETWPaBdRBVE2+A9cTHVkJ0v0At XDDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764185822; x=1764790622; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=S9VX4Wwm6Gu8sDkxRY5IZbodfOdqEkYeGpnLMouiQXg=; b=i44vAxUwd69+NyDWvZKGAgZu/k8dXjJhOchldmNqlVTazwrts2pv7o4RbOZIZS7yx9 zTv1zBPTaZvnbIr5FPn2VeMfDZ4mjGGyUcabjEzWnD0uNOfMht9+GsfxA3q3dfrZuDrj rEIwb7T3ivueYNMJQLLBW/pCpLbgBIqxIoBRpoHJQMR6cjYPkHi3k7n0MaudGmhZ+4BS LH8SbTb6jzewkENb4f6MITgCN0Nth1nFtO/3zbJeHq6/7DzqpvFBMso1pvz289CpawIt AqrFqk2WteS+1b8qdYyrdTBUDWuLLutlJqOTYPy8Y40TInDAel/98zcGbE1B+vsYh4ut nQtQ== X-Gm-Message-State: AOJu0YwCaneczE6sfagK3jDAE8G3nshjICvDZ5y0qHtcL1f9XbCJJkY+ 2yptrbF65wS2Z+mEFNjCEmCvmRFQWwG+Ln3l/T7KgJlx1+O7Di+zxomAb6qKgQ== X-Gm-Gg: ASbGnct8NDB2Psc5u8c59BcFSldM4FHtHhTP2lALCfPgfIPYHd9ig5DVopVnn782Jxv W/zaydq1/dseQGS3u0cqikNZVB6JcK0SA4ATtpnSVKu61kb4QNlIk1t9goaDCCajRYb0CBEWcTv Jr/6hgVnTF/Tf4QIpAoDSeBv6SytleNUVhnKaqCbOlTiwpRZ3n1u5grJbGN+7HCwq1dgDDGG1jz XJZC/Sc9AWV4vpaxDw3erv0rh6oUdWJ1tvpLOb/i9n4U34CHPBsJRebpWYVvZpJSgqVvfALonos 7xp0MbEcaCwcBHGajjqVUI7IvE+9y5vIrZoRaNa37v34u61i58IWq0VdA5Xw8K+mWvZTR40kLR3 6QuyJSem6zGmME6DdACrcktFveoNMUmCE/8XD281Rb//MA+TEq4q/OLeT+11Znddo1jWiVwI05K iwAFjI5MCMH8jvezxwYOASOfUkjx2YZPCxe1KI6uG0q+t2toeDCaWRg7sswoRy2XPGvPkAHRodU tlN8ixPE3eZ8YTcJ6GuyvpzTTCFJqBtg7oSsfnCsz1+1A== X-Google-Smtp-Source: AGHT+IGpGHYnml9aFeOPxKpffOErlududqgFmIQNo8hN8CWjaFUXSr2CgE4XGWexcGzynMfAkb41oA== X-Received: by 2002:a05:690e:12c9:b0:63f:a4d7:b523 with SMTP id 956f58d0204a3-64329320ad2mr5393357d50.28.1764185822119; Wed, 26 Nov 2025 11:37:02 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 00721157ae682-78a798a5737sm69617587b3.16.2025.11.26.11.37.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Nov 2025 11:37:01 -0800 (PST) From: Demi Marie Obenour Date: Wed, 26 Nov 2025 14:34:08 -0500 Subject: [PATCH v4 10/13] release: Create directory with system update MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251126-updates-v4-10-40c438d2dcaf@gmail.com> References: <20251126-updates-v4-0-40c438d2dcaf@gmail.com> In-Reply-To: <20251126-updates-v4-0-40c438d2dcaf@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1764185638; l=2715; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=Mgvu8BW7eP72ntsSRlKgf49gg6rmDfEroz6Z2q3E9h0=; b=thxwW9EpVVorYJtKN7h/q6WnRWRZ44xwyjFsMUYJCl5XPh86gOtb9DRd3Dl7bjhuu/ujxPXSQ 5cQOwHSZCv0Ai9vHKCyB941H9h3y1sbTteZNRqzgLIJmDx5tx1NborB X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: OIWLA7HR7RGPU5YYFNMQSDA6RO5KHU2B X-Message-ID-Hash: OIWLA7HR7RGPU5YYFNMQSDA6RO5KHU2B X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Whenever a release is made, create a directory with the release files to be used for an update. After its SHA256SSUMS file is signed, the file is ready to be uploaded to a server for users to update from. Signed-off-by: Demi Marie Obenour Reviewd-by: Alyssa Ross --- Changes since v4: - Only set -u because stdenv sets the reset. Update comment. Changes since v2: - Use UUIDs to name the rootfs and verity superblock. This will allow systemd-sysupdate to set the correct UUIDs on the rootfs and verity partitions, avoiding the need to use labels to find these partitions. Signed-off-by: Demi Marie Obenour --- release.nix | 2 ++ release/update.nix | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/release.nix b/release.nix index a4fe66ee5925aeee3a1f5f1fac249c595cee0885..704abb39a3d01152eac3dfe313066834c3cd0a66 100644 --- a/release.nix +++ b/release.nix @@ -8,5 +8,7 @@ import lib/call-package.nix ({ callSpectrumPackage }: { checks = callSpectrumPackage release/checks {}; + updates = callSpectrumPackage release/update.nix {}; + combined = callSpectrumPackage release/combined/run-vm.nix {}; }) (_: {}) diff --git a/release/update.nix b/release/update.nix new file mode 100644 index 0000000000000000000000000000000000000000..18a91ac1eea56e9b2a941eb08244b3dee613b721 --- /dev/null +++ b/release/update.nix @@ -0,0 +1,33 @@ +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2021-2024 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour + +import ../lib/call-package.nix ( +{ callSpectrumPackage, config, runCommand, stdenv }: + +let + efi = import ../host/efi.nix {}; +in +runCommand "spectrum-update-directory" { + __structuredAttrs = true; + unsafeDiscardReferences = { out = true; }; + dontFixup = true; + env = { VERSION = config.version; }; +} '' + # stdenv sets -eo pipefail, but not -u + set -u + mkdir -- "$out" + cd -- "$out" + read -r roothash < ${efi.rootfs}/rootfs.verity.roothash + if ! [[ "$roothash" =~ ^[0-9a-f]{64}$ ]]; then + printf 'Internal error: bad root hash %q\n' "$roothash" + exit 1 + fi + cp -- ${efi} "Spectrum_$VERSION.efi" + cp -- ${efi.rootfs}/rootfs.verity.superblock "Spectrum_''${VERSION}_''${roothash:32:32}.verity" + cp -- ${efi.rootfs}/rootfs "Spectrum_''${VERSION}_''${roothash:0:32}.root" + sha256sum -b "Spectrum_$VERSION.efi" \ + "Spectrum_''${VERSION}_''${roothash:32:32}.verity" \ + "Spectrum_''${VERSION}_''${roothash:0:32}.root" > SHA256SUMS + '' +) (_: {}) -- 2.52.0